Skip to content

Commit 2d40010

Browse files
he-yufenghe-yufeng
committed
Merge remote-tracking branch 'upstream/main' into fix/issue-update-close-response
# Conflicts: # pkg/github/issues.go
2 parents 03febb4 + e3809fe commit 2d40010

496 files changed

Lines changed: 99278 additions & 13686 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/build-ui/action.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,25 +1,26 @@
11
name: Build UI
2-
description: Restore cached UI HTML artifacts, or set up Node and run script/build-ui on cache miss.
2+
description: Restore tested UI HTML artifacts, or set up Node and run script/build-ui on cache miss.
33

44
runs:
55
using: composite
66
steps:
77
- name: Cache UI artifacts
88
id: cache-ui
9-
uses: actions/cache@v5
9+
uses: actions/cache@v6
1010
with:
1111
path: |
1212
pkg/github/ui_dist/get-me.html
1313
pkg/github/ui_dist/issue-write.html
1414
pkg/github/ui_dist/pr-write.html
15-
key: ui-dist-v1-${{ hashFiles('ui/package-lock.json', 'ui/package.json', 'ui/index.html', 'ui/tsconfig*.json', 'ui/vite.config.ts', 'ui/src/**', 'ui/scripts/**') }}
15+
pkg/github/ui_dist/pr-edit.html
16+
key: ui-dist-v3-${{ hashFiles('.github/actions/build-ui/action.yml', 'script/build-ui', 'ui/package-lock.json', 'ui/package.json', 'ui/index.html', 'ui/tsconfig*.json', 'ui/vite.config.ts', 'ui/src/**', 'ui/scripts/**') }}
1617
enableCrossOsArchive: true
1718

1819
- name: Set up Node.js
1920
if: steps.cache-ui.outputs.cache-hit != 'true'
20-
uses: actions/setup-node@v6
21+
uses: actions/setup-node@v7
2122
with:
22-
node-version: "20"
23+
node-version-file: ui/package.json
2324
cache: npm
2425
cache-dependency-path: ui/package-lock.json
2526

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ updates:
99
directory: "/"
1010
schedule:
1111
interval: "weekly"
12+
- package-ecosystem: "npm"
13+
directory: "/ui"
14+
schedule:
15+
interval: "weekly"
1216
- package-ecosystem: "docker"
1317
directory: "/"
1418
schedule:
@@ -17,3 +21,5 @@ updates:
1721
directory: "/"
1822
schedule:
1923
interval: "weekly"
24+
cooldown:
25+
default-days: 7

‎.github/workflows/ai-issue-assessment.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
steps:
1616
- name: Checkout
17-
uses: actions/checkout@v6
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
1818

1919
- name: Run AI assessment
2020
uses: github/ai-assessment-comment-labeler@e3bedc38cfffa9179fe4cee8f7ecc93bffb3fee7 # v1.0.1

‎.github/workflows/close-inactive-issues.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
issues: write
1515
pull-requests: write
1616
steps:
17-
- uses: actions/stale@v10
17+
- uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
1818
with:
1919
days-before-issue-stale: ${{ env.PR_DAYS_BEFORE_STALE }}
2020
days-before-issue-close: ${{ env.PR_DAYS_BEFORE_CLOSE }}

‎.github/workflows/code-scanning.yml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@ jobs:
4141
runner: '["ubuntu-22.04"]'
4242
steps:
4343
- name: Checkout repository
44-
uses: actions/checkout@v6
44+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4545

4646
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@v4
47+
uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
4848
with:
4949
languages: ${{ matrix.language }}
5050
build-mode: ${{ matrix.build-mode }}
@@ -61,28 +61,28 @@ jobs:
6161
threat-models: [ ]
6262
- name: Setup proxy for registries
6363
id: proxy
64-
uses: github/codeql-action/start-proxy@v4
64+
uses: github/codeql-action/start-proxy@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
6565
with:
6666
registries_credentials: ${{ secrets.GITHUB_REGISTRIES_PROXY }}
6767
language: ${{ matrix.language }}
6868

6969
- name: Configure
70-
uses: github/codeql-action/resolve-environment@v4
70+
uses: github/codeql-action/resolve-environment@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
7171
id: resolve-environment
7272
with:
7373
language: ${{ matrix.language }}
7474
- name: Setup Go
75-
uses: actions/setup-go@v6
75+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
7676
if: matrix.language == 'go' && fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version
7777
with:
7878
go-version: ${{ fromJSON(steps.resolve-environment.outputs.environment).configuration.go.version }}
7979
cache: false
8080

8181
- name: Set up Node.js (for JavaScript CodeQL)
8282
if: matrix.language == 'javascript'
83-
uses: actions/setup-node@v6
83+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
8484
with:
85-
node-version: "20"
85+
node-version-file: ui/package.json
8686
cache: "npm"
8787
cache-dependency-path: ui/package-lock.json
8888

@@ -91,10 +91,10 @@ jobs:
9191
uses: ./.github/actions/build-ui
9292

9393
- name: Autobuild
94-
uses: github/codeql-action/autobuild@v4
94+
uses: github/codeql-action/autobuild@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
9595

9696
- name: Perform CodeQL Analysis
97-
uses: github/codeql-action/analyze@v4
97+
uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
9898
env:
9999
CODEQL_PROXY_HOST: ${{ steps.proxy.outputs.proxy_host }}
100100
CODEQL_PROXY_PORT: ${{ steps.proxy.outputs.proxy_port }}

‎.github/workflows/docker-publish.yml‎

Lines changed: 21 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -40,27 +40,27 @@ jobs:
4040

4141
steps:
4242
- name: Checkout repository
43-
uses: actions/checkout@v6
43+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
4444

4545
# Install the cosign tool except on PR
4646
# https://github.com/sigstore/cosign-installer
4747
- name: Install cosign
4848
if: github.event_name != 'pull_request'
4949
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2
5050
with:
51-
cosign-release: "v2.2.4"
51+
cosign-release: "v3.1.3"
5252

5353
# Set up BuildKit Docker container builder to be able to build
5454
# multi-platform images and export cache
5555
# https://github.com/docker/setup-buildx-action
5656
- name: Set up Docker Buildx
57-
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
57+
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
5858

5959
# Login against a Docker registry except on PR
6060
# https://github.com/docker/login-action
6161
- name: Log into registry ${{ env.REGISTRY }}
6262
if: github.event_name != 'pull_request'
63-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
63+
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
6464
with:
6565
registry: ${{ env.REGISTRY }}
6666
username: ${{ github.actor }}
@@ -70,7 +70,7 @@ jobs:
7070
# https://github.com/docker/metadata-action
7171
- name: Extract Docker metadata
7272
id: meta
73-
uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
73+
uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
7474
with:
7575
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
7676
tags: |
@@ -87,7 +87,7 @@ jobs:
8787
type=raw,value=latest,enable=${{ github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
8888
8989
- name: Go Build Cache for Docker
90-
uses: actions/cache@v5
90+
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
9191
with:
9292
path: go-build-cache
9393
key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
@@ -106,7 +106,7 @@ jobs:
106106
# https://github.com/docker/build-push-action
107107
- name: Build and push Docker image
108108
id: build-and-push
109-
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
109+
uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
110110
with:
111111
context: .
112112
push: ${{ github.event_name != 'pull_request' }}
@@ -116,20 +116,26 @@ jobs:
116116
cache-to: type=gha,mode=max
117117
platforms: linux/amd64,linux/arm64
118118
build-args: |
119-
VERSION=${{ github.ref_name }}
119+
VERSION=${{ github.ref_type == 'tag' && github.ref_name || 'dev' }}
120+
secrets: |
121+
oauth_client_id=${{ secrets.OAUTH_CLIENT_ID }}
122+
oauth_client_secret=${{ secrets.OAUTH_CLIENT_SECRET }}
120123
121124
# Sign the resulting Docker image digest except on PRs.
122-
# This will only write to the public Rekor transparency log when the Docker
123-
# repository is public to avoid leaking data. If you would like to publish
124-
# transparency data even for private images, pass --force to cosign below.
125+
# Publish both v2-compatible .sig tags and native Sigstore bundles.
126+
# --yes also consents to publishing signing metadata to the public log.
125127
# https://github.com/sigstore/cosign
126-
- name: Sign the published Docker image
128+
- name: Sign the published Docker image (legacy)
127129
if: ${{ github.event_name != 'pull_request' }}
128130
env:
129131
# https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
130-
TAGS: ${{ steps.meta.outputs.tags }}
131132
DIGEST: ${{ steps.build-and-push.outputs.digest }}
132133
# This step uses the identity token to provision an ephemeral certificate
133134
# against the sigstore community Fulcio instance.
134-
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
135-
135+
run: cosign sign --yes --new-bundle-format=false --use-signing-config=false --registry-referrers-mode=legacy "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"
136+
137+
- name: Sign the published Docker image (native bundle)
138+
if: ${{ github.event_name != 'pull_request' }}
139+
env:
140+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
141+
run: cosign sign --yes "${REGISTRY}/${IMAGE_NAME}@${DIGEST}"

‎.github/workflows/docs-check.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,13 @@ jobs:
1414
runs-on: ubuntu-latest
1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@v6
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
1818

1919
- name: Build UI
2020
uses: ./.github/actions/build-ui
2121

2222
- name: Set up Go
23-
uses: actions/setup-go@v6
23+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
2424
with:
2525
go-version-file: 'go.mod'
2626

‎.github/workflows/go.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,13 @@ jobs:
2323
git config --global core.eol lf
2424
2525
- name: Check out code
26-
uses: actions/checkout@v6
26+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2727

2828
- name: Build UI
2929
uses: ./.github/actions/build-ui
3030

3131
- name: Set up Go
32-
uses: actions/setup-go@v6
32+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
3333
with:
3434
go-version-file: "go.mod"
3535

‎.github/workflows/goreleaser.yml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,21 @@ jobs:
1414

1515
steps:
1616
- name: Check out code
17-
uses: actions/checkout@v6
17+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
1818

1919
- name: Build UI
2020
uses: ./.github/actions/build-ui
2121

2222
- name: Set up Go
23-
uses: actions/setup-go@v6
23+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
2424
with:
2525
go-version-file: "go.mod"
2626

2727
- name: Download dependencies
2828
run: go mod download
2929

3030
- name: Run GoReleaser
31-
uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89
31+
uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
3232
with:
3333
distribution: goreleaser
3434
# GoReleaser version
@@ -38,9 +38,11 @@ jobs:
3838
workdir: .
3939
env:
4040
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41+
OAUTH_CLIENT_ID: ${{ secrets.OAUTH_CLIENT_ID }}
42+
OAUTH_CLIENT_SECRET: ${{ secrets.OAUTH_CLIENT_SECRET }}
4143

4244
- name: Generate signed build provenance attestations for workflow artifacts
43-
uses: actions/attest-build-provenance@v4
45+
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
4446
with:
4547
subject-path: |
4648
dist/*.tar.gz

‎.github/workflows/license-check.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424

2525
steps:
2626
- name: Check out code
27-
uses: actions/checkout@v6
27+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
2828

2929
# Check out the actual PR branch so we can push changes back if needed
3030
- name: Check out PR branch
@@ -36,7 +36,7 @@ jobs:
3636
uses: ./.github/actions/build-ui
3737

3838
- name: Set up Go
39-
uses: actions/setup-go@v6
39+
uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
4040
with:
4141
go-version-file: "go.mod"
4242

@@ -70,7 +70,7 @@ jobs:
7070
- name: Check if already commented
7171
if: steps.changes.outcome == 'failure' && steps.push.outcome == 'failure'
7272
id: check_comment
73-
uses: actions/github-script@v9
73+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
7474
with:
7575
script: |
7676
const { data: comments } = await github.rest.issues.listComments({
@@ -88,7 +88,7 @@ jobs:
8888
8989
- name: Comment with instructions if cannot push
9090
if: steps.changes.outcome == 'failure' && steps.push.outcome == 'failure' && steps.check_comment.outputs.already_commented == 'false'
91-
uses: actions/github-script@v9
91+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
9292
with:
9393
script: |
9494
await github.rest.issues.createComment({

0 commit comments

Comments
 (0)